WPScan

Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link

GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal